PT-2019-19020 · Linux Foundation +1 · Linux +1

Name of the Vulnerable Software and Affected Versions: Xiaomi MIX 2 devices with kernel version 4.4.78 Description: A NULL pointer dereference issue exists in the ioctl interface of the device files /dev/elliptic1 or /dev/elliptic0, which can cause a system crash when IOCTL 0x4008c575 decimal...

glusterfs: I/O to arbitrary devices on storage server

It was found that the "mknod" call derived from mknod2 can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node...

UBUNTU-CVE-2018-10923

It was found that the "mknod" call derived from mknod2 can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node...

glusterfs: I/O to arbitrary devices on storage server

It was found that the "mknod" call derived from mknod2 can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node...

GLSA-201808-02 : LinuX Containers user space utilities: Arbitrary file read

The remote host is affected by the vulnerability described in GLSA-201808-02 LinuX Containers user space utilities: Arbitrary file read lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check...

USN-3500-1 libxfont, libxfont1, libxfont2 vulnerability

It was discovered that libXfont incorrectly followed symlinks when opening font files. A local unprivileged user could use this issue to cause the X server to access arbitrary files, including special device files...

Trend Micro Internet Security access restriction flaw

Overview Trend Micro Internet Security provided by Trend Micro Incorporated contains an access restriction flaw. According to the developer, attempts to exploit the vulnerability will not succeed from external networks when the default settings are used. Trend Micro Incorporated reported this...

CVE-2011-5321

The ttyopen function in drivers/tty/ttyio.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via crafted access to a device file under the...

[SECURITY] Fedora 22 Update: duplicity-0.6.25-3.fc22

Duplicity incrementally backs up files and directory by encrypting tar-format volumes with GnuPG and uploading them to a remote or local file server. In theory many protocols for connecting to a file server could be supported; so far ssh/scp, local file access, rsync, ftp, HSI, WebDAV and Amazon ...

Code injection

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

DEBIAN-CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

CVE-2013-1766 affects libvirt (libvirtd) prior to version in Debian squeeze; the daemon would change ownership of device files to the kvm group, enabling local users to write to those devices via unspecified vectors. Impact described as local access to files/devices with potential for partial int...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

CVE-2013-1766

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors...

DEBIAN-CVE-2004-2768

dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable 1 setuid file, 2 setgid file, or 3 device, a related issue to CVE-2010-2059...

RHEL 4 : autofs5 (RHSA-2007:1177)

Updated autofs5 technology preview packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The autofs utility controls the operation of the automount daemon, which...

Default configuration

The default configuration for autofs 5 autofs5 in some Linux distributions, such as Red Hat Enterprise Linux RHEL 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special devic...

CVE-2007-6285

The default configuration for autofs 5 autofs5 in some Linux distributions, such as Red Hat Enterprise Linux RHEL 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special devic...